Quantum cryptography with polarization, phase and time encoding 
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We develop and present a quantum cryptography concept in which phase determinations are made 
from the time that a photon is detected, as opposed to where the photon is detected, and hence is a 
non-interferometric process. The phase-encoded quantum information is contained in temporal and 
polarization superpositions of single photon states, forming a complex qudit of Hilbert dimension 
D > 4. Based on this, we have developed a new quantum key distribution protocol that allows the 
generation of secret key in the presence of higher noise than is possible with other protocols. 

PACS numbers: 03.67.Dd, 03.67.Hk, 42.50.Dv 



Bennett and Brassard proved the merit of Weisner's 
quantum cryptography (QC) foundations [l| in 1984 with 
their presentation of the first mature quantum key distri- 
bution (QKD) protocol known as BB84 [2(], which they 
experimentally demonstrated in 1989 Their protocol 
relies on transmission of a single photon onto a quan- 
tum communication channel by one party, Alice, to her 
partner with whom she wishes to share a secret, Bob. 

The original scheme encodes information on a photon 
by preparing it in one of four definite polarizations: a hor- 
izontal or vertical polarized photon \ h) or \v) (h or v), or a 
left- or right-diagonal polarized photon \d) = (h — v)/y/2 
or \d) = {h + v)/\/2 (J or d) (the early BB84 polarization 
protocol was investigated in fiber [4, 5]). As the photons 
arrive to Bob, he randomly measures their polarizations 
in one of the two preparation bases, h-v or d-d. Half 
the time Bob measures the arriving states in the wrong 
basis giving random, meaningless results, but the other 
half of Bob's measurements are in the transmitted basis, 
determining the polarizations (bit values) of the arriving 
photons. Once the information exchange is complete Bob 
publicly reveals the times of his observations and his mea- 
surement basis. Alice then publicly notifies Bob which of 
his measurements were in the wrong basis and he dis- 
cards that half of his bits to complete the sifting process. 
Bob and Alice then remove errors through a reconcilia- 
tion protocol @, 0, @, 0] , and the exchange of the secret 
is completed through application of privacy amplification 
procedures 0,@,[lQj]. At a minimum, QC requires a QKD 
protocol, with sifting, reconciliation and privacy amplifi- 
cation protocols, but more procedures, such as signature 
authentication, may be required to ensure provable secu- 
rity. 

Bennett extended QC to fiber-based phase-encoding 
schemes in 1992 [ll| when he showed that QKD could 
be effected through use of a pair of Franson's unbalanced 
Mach-Zehneder interferometers (MZIs) [l2j |. Fiber based 
BB84 phase-encoding QKD protocols typically encode 



photons with one of four phases, (j>i = 0, 7r, 7r/2, or 37r/2, 
and bit values are determined as or 1 when Bob ran- 
domly adds a phase of or tt/2 to arriving photons, e.g., 
A(j) = = 0, and = tt = 1, (see [13]). The basis 
choice remains random yielding a theoretical protocol ef- 
ficiency of T] p = 1/2 in a polarization switched system 

0. 

In this manuscript we develop a QKD concept in which 
Bob transmits a temporal superposition of BB84 polar- 
ization states to Alice through an unbalanced MZI. For 
her part, Alice encodes phase information on the the ar- 
riving states with a phase shift of fa = or 7r and then 
returns them to Bob. The polarization, phase and time 
encoding causes a complex qudit of high Hilbert dimen- 
sion, allowing Bob to determine some phase-differences 
from the timing of photon detections, without entangle- 
ment or interferometric phase determination, to create a 
QC protocol of high efficiency and improved security. 

The complex qudit presents with a high disturbance to 
eavesdropping, and maximizes the number of phase dif- 
ferences Bob can determine, which reduces the informa- 
tion an eavesdropper, Eve, can acquire. The reduction 
in information leakage implies that Bob and Alice can 
tolerate a higher error rate than presently known QKD 
protocols and still share a secret [H, [l6[ . The protocol is 
enabled by the encoding of four random phases of or tt 
on the temporal and polarization superpositions, of the 
BB84 polarization states, through a phase-gate switch 
that breaks the Faraday mirror symmetry used in plug- 
and-play QKD [13, El, G1 . 

Figure [1] presents Bob's optics. His photon source is 
typically an attenuated laser source, but for the sake of 
argument we consider ideal single photon QKD. In this 
approach, a photon emitted from the source first encoun- 
ters the polarization controller adjusted to transmit h. 
Next, the first polarizing beamsplitter (PBSi) transmits 
h toward the 45° Faraday rotator, F45, whose operation 
rotates h to d. Following F45 is Ho that, when the photon 
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is traveling this direction, causes a 45° half- wave retarda- 
tion that rotates d back to ft: H$\d) = ft = H^F^h) = ft, 
but when the photon returns, F^Ho\h) = v, causing pho- 
tons returning on this path to reflect to SPCMi. This ft 
state is then superposed at the 50-50 beamsplitter (BS), 
with one superposition traveling the longer upper arm, 
and the other the shorter lower arm of the unbalanced 
MZI. The upper arm includes Hi that causes a 90° half- 
wave retardation that rotates ft to v: H\\h) = v, and 
Hi\v) = — ft on the returning photons. The unbalanced 
MZI is completed with PBS2 that transmits ft and re- 
flects v such that exiting the unbalanced MZI onto the 
quantum channel from Bob to Alice is tto, a dim-pulse 
superposition of v delayed by At following ft, 
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where i is the phase shift resulting from reflection from 
the BS, r = t + z/c — t f is the relative time from the 
beginning of Bob's transmission (the beginning of trans- 
mission is often heralded by Bob to Alice with a bright 
timing pulse at At relates the length difference of the 
MZI short and long arms and is chosen long enough to 
allow operation of the Pockels cells (PCs) on both su- 
perpositions of tto [13] > = e lUJT S(r), S(r) is a narrow 
envelope function with temporal width much greater that 
1/oj but less than At, and c is the photon group velocity. 

Assume the PCs transform the states as follows, where 
we choose = 0, ±7r/4, or ir/2 to leave ft or v unchanged, 
or to transform ft to d, d or v, or to transform v to d, 
d or ft. Consider the general case in which Bob applies 
rotation a\ to the early ft, and rotation 012 to the late 
v so that after the PCs Bob has prepared superposition 
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FIG. 1: Bob's optical system includes a single photon source, 
two single photon counting modules (SPCMs), two polarizing 
beamsplitters (PBSs), a 45° Faraday rotator (.F45), two fixed- 
angle half- wave retarders (Ho and Hi), a 50-50 beamsplitter 
(BS), and two Pockels cells (PCi and PC 2 ). 



b and sent it on to Alice: 
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Figure [2] shows Alice's optics [2l|. As arrives, her 
polarization controller corrects for the polarization ro- 
tations caused by the quantum channel, usually single- 
mode fiber, and her PBS then causes a spatial superpo- 
sition of the arriving polarizations to form. For example, 
ft positions of ^b pass directly to phase modulator PM, 
and the v positions reflect downward. The ft position of 
the first (earliest) temporal superposition encounters the 
PM first, and a phase = or tt is added before it passes 
to Ha, which rotates it to v; the downward reflected v po- 
sition first passes through Ha and is rotated to —ft, and 
it is then given phase <p2 = or ir as it passes through the 
PM; next, these two phase- modulated and polarization- 
switched superpositions recombine at the PBS at the ear- 
liest time position. A similar process occurs to the ih 
and iv positions of the later temporal position. That is, 
the ih polarization passes directly through the PBS to 
the PM that adds phase ^3 = or tt to the position, 
and it is then rotated to iv by Ha; the iv position is 
reflected downward by the PBS, rotated to — ih by Ha, 
and given ^4 = or tt by the PM; the phase- modulated 
and polarization-switched superpositions then recombine 
at the PBS at the latest time position of the temporal su- 
perposition to form ^ a. 
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which Alice directs toward the polarization controller. 
The controller then inverts its earlier rotations before di- 
recting the temporal, polarization, and phase modulated 
qudit onto the quantum channel to Bob. It is a subtle 
point, but, if Bob sent to Alice a state that includes a 
d or d within the superposition, after passing through 
the phase-gate switch that position appears to have been 
reflected back to him from a mirror: d 1— > d and d 1— > d. 
However, if his superpositions included v or ft, those posi- 
tions will appear to have been switched, in his coordinate 
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FIG. 2: Alice's optical system is a phase-gate switch that 
includes an actively aligned polarization controller and a PBS 
followed by a loop with one phase modulator (PM), and a 90° 
half- wave retarder, Ha [Sj]. This phase gated switch does not 
rotate the polarizations 90° as a Faraday mirror in plug-and- 
play 
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system: h \—> v and v i— > h. In contrast, if Alice's optics 
behaved as a Faraday mirror, e.g., the operations on the 
states effect a 90° rotation in all cases: h i— > ±i>, d i— > ±J, 
v i — ^ =f/i, and d from Bob's perspective. 

As arrives to Bob, he appropriately modulates his 
two PCs to select 03 and 04 to determine most of the 
phases Alice has added to the h and v polarizations to 
form the generalized state, ty' B after his PCs and prior 
to PBS 2 : 
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Then, as enters the MZI, PBS2 superposes the early 
and late time positions, based on polarizations, to form 
yet another temporal superposition. For example, at 
the earliest time position the h position passes directly 
through to time r+0, and the v position travels the upper 
arm to time r + At; similarly, at the latest time position 
the h positions pass directly through to time r + At, and 
the v position travels the upper arm to time r + 2 At. 
The photon will be detected on coherence at one of these 
three times, on one of the two SPCMs, based on Bob's 
decoding operations. 

To complete a QKD protocol, we consider three gen- 
eral classes of PC rotations. The first class is when 
Bob chooses (oi,o 2 ) = (0,0), (0,tt/2), (tt/2,0), or 
(7r/2,7r/2). In this situation, Bob can overlap and in- 
terfere his states with efficiency 77 = 1 at time r + At by 
choosing (063,064) = (01,02) to determine A</>4i, A</>3i, 
A042, and A</>32, respectively, on one of his two SPCMs. 
After Bob makes these phase difference determinations 
he notifies Alice of the relative time r (the absolute time 
that includes At is not needed) of the observation and 
his measurement basis (A^i, A^i, A^, or A(j)s 2 ). 

The second class is when Bob chooses (01,02) = 
(0,7r/4), (7r/2,7r/4), (0,-tt/4), (tt/2, -tt/4), (-tt/4,0), 
(— 7r/4, 7r/2), (7r/4,0), or (7r/4,7r/2). In these situations, 
Bob chooses 03 = tt/2 if 01 = 0, and as = if 01 = 7r/2, 
to cause an early-time coherence of h or v of his super- 
position to randomly trigger either SPCMi or SPCM2 at 
the earliest possible detection time r + 0, without inter- 
ference and no phase difference determination. Similarly, 
Bob chooses 04 = tt/2 if 02 = 0, and 04 = if 02 = tt/2, 
to cause a late-time coherence of ih or iv of his super- 
position to randomly trigger either SPCMi or SPCM2 
at the latest possible detection time r + 2 At, without 
interference or any phase determination. In the first sit- 
uation (early-time h or v transmission, i.e., a± = or 
7r/2), Bob chooses a 4 = 7r/4, and in the latter situation 
(late-time ih or iv transmission) Bob chooses as = 7r/4. 
Bob ignores the 1 /2 of these detections that are random 
as they convey no phase information. For the remain- 
ing cases Bob finds with 77 = 1/2 that the polarization 
of his photon, and thus the time of an observation, de- 
pends on A02i or A043, respectively, and he notifies Al- 



ice of the relative time r of his detection and the mea- 
surement basis. For example, consider that Bob chose 
(01, 02, 03, a 4) = (0, 7r/4, 7r/2, 7r/4). This gives 
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prior to PBS2 demonstrating that the earliest detections 
after Sfr' B passes through the MZI are indeterminate, but 
any detection on any SPCM at time r + At determines 
that A(/>43 = ±7r, and that a detection on any SPCM 
at time r + 2 At determines that A</>43 = 0. Thus, Bob 
determines Alice's phase differences by when he detected 
a photon, the time of the event, rather than where he 
detected a photon, or interferometric determination [22I ]. 

The third class to consider is when Bob chooses 
(oi,o 2 ) = (71-/4,71-/4), (71-/4,-71-/4), (-tt/4, tt/4), or 
(— 7r/4, — 7r/4). This class is similar to the second in 
that he determines phase differences based on the time 
of detections rather than by interferometric means. He 
chooses his rotations to determine A(j) 2 i at time r + 0, 
and A043 at time r + 2 At with efficiency n = 1/2. 
For example, suppose that Bob chose (01,02,03,04) = 
(7r/4, -7r/4, 7r/4, 7r/4). This gives 
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prior to PBS2. Detections at time r+0 determine A(j) 2 i = 
0, and detections at time r + 2At determine Afas = ±7r, 
while detections at time r + At are not determined, or are 
effectively random [22[. As usual, Bob notifies Alice of 
the relative time r and phase basis of his determination. 

With these physics Bob and Alice build a QKD pro- 
tocol that allows determination of A02i, A03i, A04i, 
A(/>32, A042, or A(/>43. The protocol is most easily bal- 
anced by Bob sending one of the (h,ih), (h,iv), (v,ih), 
or (v, iv) states as often as he sends any of the remain- 
ing twelve polarization combinations giving r] p = 0.75, 
but Alice and Bob could also balance the protocol by ex- 
tending the class-two and class-three degrees of freedom, 
with a lower r] p , by choosing 03 and 04 to interferometri- 
cally determine Afoi, A032, A04i, or A(j)4 2 with 77 = 1/2 
at time r + At. 

A complete error analysis of this protocol will evalu- 
ate the audit security against individual [23[ , coherent 
HI, 3, and cloning 0, [H, El attacks. These at- 
tacks consider the Hilbert dimension D and the number 
of conjugate bases. For our case, Bob has prepared and 
sent a qudit with D = 4, which was shown in ll5L [lq| 
that it can be secure for disturbances of up to 25% [301 ] . 
As Bob's qudit arrives Alice then switches the polariza- 
tions and adds four phases to the qudit prior to its return 
to Bob, increasing the allowable disturbance further. 

These strong attacks typically require Eve to store her 
probe until after Bob and Alice publicly announce their 
measurement basis, implying that if Alice and Bob sim- 
ply encrypt their sifting communications, or even simply 
wait some time to sift their quantum communication, 



3 



LA-UR-08-2796 



that they can guard against these attacks. Neverthe- 
less, these strategies define the strictest bounds on the 
key rates of QKD protocols against generalized attacks. 
Upon defeat, however, a reasonable attack by Eve is the 
intercept-resend strategy, and it should be evaluated as 
well. 

Due to the number of degrees of freedom in the qu- 
dit, Alice and Bob have many choices that have all been 
shown to be more secure against eavesdroppi ng J15L Il6| . 
They could even effect free-space QKD 0, [3l|, I32I. l33l J34j 
with Bob's qudit alone, with enhanced security and 
equivalent efficiency as BB84. 

In summary, we have developed and analyzed three 
physics concepts that enhance the security of quantum 
cryptography. First, we developed (Bob's) optics that 
exploit polarization and time encoding to form a complex 
qudit with D = 4, which presents with a high tolerance 



to eavesdropping. Next, we fashion a phase-gate switch 
that breaks the plug-and-play Faraday mirror symmetry 
by switching incident polarizations in a manner that al- 
lows addition of a single relative phase to arriving polar- 
ization superpositions, increasing the security of the qu- 
dit further against eavesdropping. Finally, we presented 
the complex qudit realization of differential phase deter- 
mination without inter ferometric means. These elements 
can be used to establish a QKD protocol that exploits 
time, phase, and polarization encoding, providing signif- 
icantly improved immunity to errors, and some of the 
elements may have broader uses in the general quantum 
information field. In addition, the security check is better 
than any other protocol described to date. In our pre- 
sentation, we have assumed a single photon source. In 
the case of a weak coherent source, the security will of 
course be reduced as in all QKD systems. 
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